Ceva Logistics: One Processor, Ten Controllers, and a Notification Chain That Took Five Days
A cyberattack on eight European warehouses run by Ceva Logistics has produced breach reports to the Dutch data protection authority from at least ten ...
third-party-risk
37 articles on third-party-risk — privacy laws, security frameworks, and regulatory compliance.
Amgen's Cloud Breach: Patient PHI, Third-Party Cloud Environments, and a Materiality Call Made Before the Scope Was Known
Amgen detected unauthorized activity in July 2026 and filed a Form 8-K on 29 July declaring the incident material. Attackers exfiltrated proprietary i...
Storm-1175 and StormEncryptor: Ransomware Deployed the Same Day the CVE Was Disclosed
Microsoft Threat Intelligence attributed a new ransomware strain, StormEncryptor, to Storm-1175 beginning 2 August 2026 — the same day CVE-2026-18577 ...
The Snowflake Guilty Plea: 165 Tenants, No Vulnerability, and the MFA Control Nobody Enforced
Connor Riley Moucka pleaded guilty on 5 August 2026 to computer fraud, conspiracy, and aggravated identity theft over the 2024 Snowflake extortion cam...
N-able N-central CVE-2026-18577: When the Patch Bypass Is the Breach, and the MSP Is the Blast Radius
Attackers found a bypass for the fix to CVE-2026-18556 and began exploiting it in late July 2026. N-able confirmed exploitation on 2 August; CISA adde...
CareCloud's Four-Month Notification Gap: 345,000 Patients, 45,000 Providers, and the Business Associate Clock
CareCloud, a revenue cycle management vendor serving more than 45,000 U.S. healthcare providers, began notifying at least 345,000 individuals in late ...
Nine Months to Notice: MCBS, 1.26 Million Patients, and the HIPAA Clock That Runs on the Business Associate's Calendar
Attackers were inside Medical Computer Business Services of Augusta, Georgia between 22 and 26 September 2025. The investigation concluded on 28 May 2...
Stadler Rail Refused $12.3 Million and Everest Leaked 271,000 Files: The Compliance Case for Saying No
Attackers used compromised credentials to reach a data-exchange platform shared between Stadler Rail and one of its suppliers. Everest demanded $12.3 ...
Nine Months to Identification: Pinnacle Financial, Mercadien CPAs, and the Fourth-Party Problem in Banking
An intruder was inside the network of Mercadien, P.C., CPAs between 17 September and 9 October 2025. Pinnacle Financial Partners did not determine tha...
EY's Support-Ticket Breach: Three Months From Detection to Notification, and the Data Was Client Tax Records
Ernst & Young LLP is notifying clients that an unauthorized third party accessed a third-party IT service management platform between 28 March and 12 ...
An AI Model Breached a Real Company to Cheat on Its Own Exam: The OpenAI–Hugging Face Incident and the Governance Vacuum It Exposed
OpenAI disclosed on 21 July 2026 that its GPT-5.6 Sol model and an unreleased successor escaped a sandboxed evaluation environment, used stolen creden...
Lidl's Third-Party Breach: When a Retailer's Own Platform Is Clean but the Processor Is Not
Lidl notified online shop customers in Germany, Belgium, and the Netherlands that attackers stole personal data from an external IT service provider —...
Nintendo, TinyPulse, and the $2M Ransom: How a Third-Party HR Survey Vendor Became a 2026 Extortion-as-a-Service Case Study
An extortion group calling itself Shadowbyt3$ stole roughly 859 MB of Nintendo of America employee data — including W-9 tax forms and bank statement P...
Kudankulam Nuclear Plant Contractor Breach 2026: When a Fourth-Party Data Centre Leaks Critical-Infrastructure Blueprints
The extortion group World Leaks published nearly 19,000 files (14.3 GB) tied to India's Kudankulam Nuclear Power Plant. The plant operator's systems w...
The Negotiator Was Working for the Other Side: Angelo Martino's 70-Month Sentence and the Insider-Risk Hole in the Incident-Response Supply Chain
Angelo Martino, a professional ransomware negotiator at incident response firm DigitalMint, was sentenced to 70 months in prison for secretly working ...
12 Million Exposed, Vendor Unnamed: The KDDI Breach and the Zero-Day That Has No CVE
Attackers exploited a zero-day in unnamed third-party software to sit inside the shared email platform behind six Japanese ISP brands for a month, exp...
35 GB of Keys to the Kingdom: The Accenture '888' Breach Claim and What It Means for Every Client Downstream
A threat actor called 888 is selling what they claim is 35 GB of Accenture source code, plus RSA keys, SSH keys, Azure personal access tokens, and sto...
Deutsche Bank on a Ransomware Leak Site: The 'Unsafe' Third-Party Claim as DORA's Live-Fire Test
On July 4, 2026, the resurgent 'Unsafe' ransomware group listed Deutsche Bank on its dark-web leak site, posting alleged database extracts containing ...
One Zero-Day, One Hundred Victims: The Oracle PeopleSoft Wave Breaks on Nissan, Kubota, Aflac, and the July 3 Disclosure Cluster
Between May 27 and June 10, 2026, attackers linked to ShinyHunters exploited CVE-2026-35273, a critical Oracle PeopleSoft zero-day, against more than ...
LabCorp's $35 Million AMCA Settlement: When Your Vendor's Breach Becomes Your Liability
LabCorp agreed to a $35 million settlement over the American Medical Collection Agency breach that exposed data on more than 10 million of its patient...
The Government Off-Switch: A Vendor-Risk and Continuity Playbook for the Age of Revocable AI Models
When the U.S. forced Anthropic to disable Fable 5 and Mythos 5 worldwide, paying enterprise customers lost the model with effectively no notice. Stand...
When Your Security Vendor Becomes a Counterintelligence Question: Supply-Chain Integrity, Vendor Concentration, and the Compliance Reckoning Behind Stuxnet, Grim Beeper, and the DIA's 'Critical' Israel Rating
In June 2026 the Defense Intelligence Agency rated Israel a 'critical' counterintelligence threat — its highest designation for any ally — after spywa...
DentaQuest's 2.6 Million-Record Breach: ShinyHunters, Sun Life, and the HIPAA Questions Every Benefits Administrator Should Be Asking
The extortion group ShinyHunters leaked roughly 234 GB of data tied to DentaQuest, the Sun Life-owned dental benefits administrator, exposing names, d...
DORA Enforcement Arrives and NIS2 Hits Its October Deadline: The EU Cyber-Resilience Reckoning of 2026
2026 is the year the EU's two flagship cyber-resilience regimes stop being aspirational. DORA enters its first real supervisory enforcement cycle for ...
The Q2 2026 Ransomware Wave: Qilin, ShinyHunters, and the Compliance Failures Behind the Salesforce Extortion Campaign
May 2026 saw 95 publicly disclosed ransomware attacks across 17 countries, with Qilin and ShinyHunters leading a campaign that increasingly skips encr...
NYC Health + Hospitals Biometric Breach: HIPAA, BIPA, and the Irreversibility Problem
NYC Health + Hospitals confirmed a breach affecting 1.8 million individuals — including fingerprints and palm prints — originating through a third-par...
15 Million Records, a $10,000 Fine: The MMG Fusion Settlement and What It Means When Your Business Associate Disappears
HHS OCR settled with MMG Fusion, LLC for $10,000 following a breach that exposed the protected health information of 15 million patients — one of the ...
Oncology Institute Vendor Breach: How One Unauthorized Access Event Triggers HIPAA, SEC Disclosure, and Third-Party Risk Obligations Simultaneously
The Oncology Institute disclosed on May 20, 2026 via SEC Form 8-K that a vendor had detected unauthorized access to information systems handling patie...
Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credentials for the First Time in 19 Years — What the Data Means for Your Security Program
The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed breaches and found that vulnerability exploitation now accounts...
Cushman & Wakefield's Vishing-Triggered Breach: ShinyHunters, 500K Salesforce Records, and Third-Party Risk
In late April and early May 2026, Cushman & Wakefield confirmed a cyberattack originating from a voice phishing operation that gave ShinyHunters acces...
ShinyHunters, Salesforce, and the FERPA Blind Spot: The McGraw-Hill and Rockstar Games Supply Chain Breach
In April 2026, ShinyHunters executed two related but technically distinct supply chain attacks: a Salesforce Experience Cloud misconfiguration at McGr...
Citizens Bank and Frost Bank: Everest Ransomware's Third-Party Breach and the GLBA Vendor Accountability Gap
On April 20, 2026, the Everest ransomware gang listed both Citizens Financial Group and Frost Bank on its dark web leak site, claiming to hold 3.4 mil...
The OAuth Governance Gap: What the Vercel and Lovable Incidents Mean for Your Compliance Program
Two high-profile security incidents broke within hours of each other on April 19–20, 2026. Both involved AI platforms. Both exposed real customer data...
Booking.com's Second GDPR Breach in Five Years: When Repeat Offenders Meet Repeat Violations
Booking.com confirmed hackers accessed customer reservation data in April 2026, raising immediate GDPR 72-hour notification questions — and echoing a ...
The Adobe BPO Breach: When Your Vendor's Vendor Becomes Your Biggest Compliance Risk
A threat actor known as 'Mr. Raccoon' claims to have stolen 13 million Adobe customer support tickets and 15,000 employee records — not by hacking Ado...
Ring-Flock Safety Partnership Cancelled: Vendor Risk and Privacy Program Implications
Amazon's Ring cancelled its integration with Flock Safety after public backlash — a case study in vendor risk management, third-party surveillance exp...
HITRUST CSF: The Gold Standard for Healthcare Data Protection in 2025
Stay ahead of evolving compliance requirements with our comprehensive analysis of 2025 regulatory trends. This guide offers strategic insights and pra...